move cors to seperate method, pass user to comment service